CVE-2026-92942

A flaw was found in vm2. Sandboxed code can bypass the configured timeout mechanism by using the FinalizationRegistry feature. This allows an attacker to execute a busy loop in a cleanup callback, which is invoked outside the timeout accounting. Consequently, this can block the host event loop...

CVE-2026-92959

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92942

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-92959

CVE-2026-92959 affects vm2 (a Node.js sandboxing library) versions prior to 3.11.8 . The vulnerability lies in the incomplete enforcement of the allowAsync: false option in VM and NodeVM. Although localPromise.prototype.then is patched to throw 'Async not available', the sandbox's Promise static ...

EUVD-2026-81608

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92959 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods Promise.resolve, Promise.all, Promise.race, Promise.any, and...

CVE-2026-92942

vm2 before 3.11.7 (versions ≤ 3.11.6) contains a timeout bypass that allows sandboxed code to trigger denial of service. The VM({ timeout }) option only wraps the synchronous VM#run() call, while FinalizationRegistry and WeakRef are exposed to sandboxed code unmodified. An attacker can register a...

CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-92942 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

vm2 before 3.11.7 affected versions = 3.11.6 does not enforce the VM timeout option on code executed outside the synchronous VMrun call. The timeout only wraps the single call to runScript via doWithTimeout in lib/vm.js, and FinalizationRegistry and WeakRef are exposed to sandboxed code unmodifie...

CVE-2026-88878

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When HTTP/3 is enabled, an unauthenticated remote client can exploit a timeout bypass vulnerability by trickling request body bytes. This allows the client to hold a request open indefinitely, exhausting backend connection pool...

CVE-2026-88878

Traefik (HTTP reverse proxy and load balancer) versions v2.8.2 through v2.11.55 and v3.0.0 through v3.7.11 are affected by an HTTP/3 timeout bypass. The respondingTimeouts settings (notably readTimeout, default 60s) are not applied to the HTTP/3 request path because readTimeout is enforced as a d...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

AZL-96644 CVE-2026-56853 affecting package golang 1.25.12-1

When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this...

CVE-2026-70464

rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous...

CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...

CVE-2026-70462

CVE-2026-70462 affects rsync 3.1.0 prior to 3.5.0. The vulnerability is a signed integer overflow in the I/O timeout implementation triggered by crafted MSG_IO_TIMEOUT messages carrying non-positive values. This can wrap the timeout variable to a non-positive value, preventing the timeout check f...

CVE-2026-70462 rsync 3.1.0 < 3.5.0 Signed Integer Overflow via MSG_IO_TIMEOUT

rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSGIOTIMEOUT messages carrying non-positive zero or negative values. Attackers can craft malicious MSGIOTIMEOUT...